From 65d294ad019c8ac5bba12e2c9098360bacafc9e3 Mon Sep 17 00:00:00 2001 From: nagachika Date: Sat, 22 Jul 2023 13:39:44 +0900 Subject: merge revision(s) bc3ac1872e4523334e3ed04c2bb70a55c4c43f98: [Backport #19748] [Bug #19748] Fix out-of-bound access in `String#byteindex` --- string.c | 17 +++++++---------- test/ruby/test_string.rb | 3 +++ 2 files changed, 10 insertions(+), 10 deletions(-) --- string.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to 'string.c') diff --git a/string.c b/string.c index 95f023232a..b48c54adf9 100644 --- a/string.c +++ b/string.c @@ -4048,20 +4048,21 @@ rb_str_byteindex_m(int argc, VALUE *argv, VALUE str) long pos; if (rb_scan_args(argc, argv, "11", &sub, &initpos) == 2) { + long slen = RSTRING_LEN(str); pos = NUM2LONG(initpos); - } - else { - pos = 0; - } - if (pos < 0) { - pos += RSTRING_LEN(str); if (pos < 0) { + pos += slen; + } + if (pos < 0 || pos > slen) { if (RB_TYPE_P(sub, T_REGEXP)) { rb_backref_set(Qnil); } return Qnil; } } + else { + pos = 0; + } if (!str_check_byte_pos(str, pos)) { rb_raise(rb_eIndexError, @@ -4069,8 +4070,6 @@ rb_str_byteindex_m(int argc, VALUE *argv, VALUE str) } if (RB_TYPE_P(sub, T_REGEXP)) { - if (pos > RSTRING_LEN(str)) - return Qnil; if (rb_reg_search(sub, str, pos, 0) < 0) { return Qnil; } -- cgit v1.2.3